Mysql-restic template to aligned with changed pod security on OCP-4.12

[hhpatel14]

Restic does not change file permission after restore. The reason it deployment was not ready on 4.12 because of change in pod security restricted:v1.24.

          securityContext:
            runAsGroup: 27
            runAsUser: 27
            fsGroup: 27
            privileged: false

When privileged: false, deployment try to set permission to GID 27. However, 27 is an invalid value. Therefore Deployment is not ready within set ”Progress deadline seconds”. Error: provider restricted-v2: .spec.securityContext.fsGroup: Invalid value: []int64{27}: 27 is not an allowed group, spec.containers[0].securityContext.runAsUser: Invalid value: 27: must be in the ranges: [1000800000, 1000809999]

When privileged: true, deployment will not try to set permission to GID 27. Therefore, this error disappeared in previous patch (https://github.com/openshift/oadp-operator/pull/1113/files ). However, this is not the reliable solution.

This patch removes GID 27, and keeps privileged: false
Other changes were just warnings when creating deployment. It was not the failure in creating pod. However, it is good that have. https://access.redhat.com/solutions/7002730

Example warnings:
W0807 22:16:26.493591 84515 warnings.go:70] unknown field "spec.template.spec.containers[0].securityContext.fsGroup" W0807 22:16:26.493950 84515 warnings.go:70] unknown field "spec.template.spec.securityContext.privileged" W0807 22:16:26.493961 84515 warnings.go:70] would violate PodSecurity "restricted:v1.24": allowPrivilegeEscalation != false (container "mysql" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "mysql" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "mysql" must set securityContext.runAsNonRoot=true), seccompProfile (pod or container "mysql" must set securityContext.seccompProfile.type to "RuntimeDefault" or "Localhost")

[hhpatel14]

/retest

[mpryc]

What about mysql-persistent-csi.yaml ?

[hhpatel14]

What about mysql-persistent-csi.yaml ?

mysql-persistent-csi has not failed yet because privileged: true. I will test csi template manually on 4.12 and make similar changes.

[hhpatel14]

/test 4.11-operator-e2e-gcp

[openshift-ci]

@hhpatel14: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hhpatel14, sseago

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• tests/e2e/OWNERS [hhpatel14,sseago]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[sseago]

/lgtm

[kaovilai]

Invalid value: 27: must be in the ranges: [1000800000, 1000809999]

Is a securityContextConstraints feature since older OCP versions.

[kaovilai]

I would recommend reviewing how to allow customers to use 27 by setting up SCCs to allow exceptions.